CVE-2026-9586
|
| |
|
|
Software afectado |
POSTGRESQL |
|
|
|
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-9586 |
